DPDP Act for Staffing and HR Tech Companies: A Compliance Guide
TL;DR
Staffing firms, RPOs, job platforms and HR tech vendors hold some of the largest personal data sets in India: candidate databases running to millions of records. Under the DPDP Act, they are usually Data Fiduciaries for their own databases and processors for client work. Sharing CVs with clients needs candidates' informed agreement, databases need retention limits, AI screening must be transparent, and deployed workers' data must be handled as an employer's.
Who this is for: founders, compliance and operations leaders at staffing agencies, RPO providers, executive search firms, job portals and HR technology companies.
Few businesses are as data-intensive as staffing. A mid-sized agency may hold hundreds of thousands of candidate profiles; a large job platform holds millions. The business model depends on moving that data: from candidates to recruiters, from recruiters to clients, from portals into applicant tracking systems. Under the DPDP Act, each of those movements needs a lawful basis, a clear purpose and a record.
For the general rules on candidate data, see candidate data under DPDP. This guide covers what is specific to the staffing and HR tech sector.
Roles: fiduciary, processor, or both
| Activity | Typical role of the staffing firm or platform |
| Building and maintaining its own candidate database | Data Fiduciary |
| Recruiting for a client using the client's process and instructions (RPO) | Often a processor for the client |
| Employing and paying contract or temporary workers deployed to clients | Data Fiduciary (as employer) |
| Payroll outsourcing for a client's own employees | Processor |
| Running an HR SaaS platform for employers | Processor for client data; fiduciary for its own analytics and marketing |
| Using client data to train its own models or products | Fiduciary for that use, which needs its own basis |
Map roles activity by activity, write them into client contracts, and see Data Fiduciary vs Data Processor for the test.
Candidate databases
Candidate databases are the sector's core asset and core risk:
- Purpose and notice. Tell candidates, at registration, what you will do with their profile: match them to roles, share it with prospective employers, contact them about opportunities.
- Consent for ongoing use. Keeping a candidate in your database for future roles and sending job alerts relies on their agreement. Record it per purpose, with the notice version.
- Retention. Set a period for inactive profiles, ask candidates to confirm they want to stay, and delete those who do not.
- Sourced profiles. Profiles taken from job portals or professional networks should be used within platform terms and for the specific vacancy, not stored indefinitely.
Sharing CVs with clients
Sending a candidate's profile to a client is a disclosure to another Data Fiduciary. Before you send it:
- tell the candidate which client, or at least which kind of client and role
- get their agreement for that submission
- send only what the client needs at that stage
- record the submission, because under Section 11 candidates can ask which fiduciaries received their data
Deployed and contract workers
For workers you employ and deploy to client sites, you are the employer: payroll, attendance, statutory contributions and records under the Labour Codes are your responsibility, generally under the employment use in Section 7(i). Clients will also process some of their data, such as site access logs and timesheets. Agree in the contract who is responsible for what, including breach notification and retention.
AI screening and matching
AI is central to modern HR tech: resume parsing, matching, ranking, chat-based screening and video interviews. Under the DPDP Act:
- tell candidates that automated tools are used and for what
- limit data to what the tool needs
- keep human review for decisions that affect candidates, such as rejections
- do not use client or candidate data to train models for other purposes without a lawful basis
- if designated a Significant Data Fiduciary, carry out the algorithmic due diligence required by Rule 13
Cross-border work
Staffing and HR tech firms often serve overseas clients or host data abroad. Section 16 permits transfers unless the destination country is restricted, so check client and hosting locations. Indian firms processing non-Indian candidates' data under contracts with foreign clients may fall within the Section 17(1)(d) exemption for that processing, though security obligations still apply.
Communications
Job alerts, WhatsApp outreach and recruiter calls are communications to individuals. Use the channels candidates agreed to, honour opt-outs across every tool, and follow TRAI rules for SMS and calls. See marketing consent under DPDP.
Checklist
Checklist
- Roles mapped per activity and written into client contracts
- Candidate notice and consent at registration, per purpose
- Candidate agreement recorded before every client submission
- Retention limits and refresh for inactive profiles
- Rules for portal-sourced data
- AI tools disclosed, minimised and subject to human review
- Employer obligations for deployed workers documented with clients
- Hosting and client locations checked under Section 16
- Opt-outs propagated across email, SMS, WhatsApp and ATS
How ConsentifyAI helps
ConsentifyAI captures candidate consent per purpose at registration, records each client submission against the candidate's profile, applies retention and refresh rules to inactive profiles, and propagates opt-outs across your ATS and communication tools, all with a tamper-evident record you can show to clients and regulators.
Sources & references
- DPDP Act, 2023 — Section 2(i), 2(k)
- DPDP Act, 2023 — Section 5, 6, 7(a), 7(i)
- DPDP Act, 2023 — Section 8(1), 8(2), 8(7)
- DPDP Act, 2023 — Sections 10, 11, 12, 16
- DPDP Rules, 2025 — Rules 3, 6, 7, 13
Frequently asked questions
Is a staffing agency a Data Fiduciary or a Data Processor?
Usually both. It is a fiduciary for its own candidate database and for the payroll of workers it employs, and often a processor when it runs recruitment or payroll on a client's instructions. Map roles per activity.
Can we share candidate CVs with clients?
Tell candidates which clients or types of clients will receive their profile, and get their agreement before sending it. Sending CVs to clients without the candidate's knowledge is high-risk.
How long can we keep candidates in our database?
Only as long as the purpose they agreed to continues. Set a retention period, refresh consent periodically, and delete inactive profiles.
Are HR tech platforms Significant Data Fiduciaries?
Designation criteria have not been notified, but large job platforms process high volumes of personal data, a key Section 10 factor. They should prepare as possible SDFs.
What about candidates sourced from job portals?
Use portal data within the portal's terms and for the specific vacancy. Tell candidates where you found their details when you contact them.
Related reading
Recruitment Under DPDP: Handling Candidate Data From Application to Talent Pool
Candidates are Data Principals too. CVs and assessments submitted for a role can be processed for that recruitment, but keeping them in a talent pool for future roles, sourcing profiles from portals and running AI screening each raise separate questions. Give candidates a clear notice, get consent for talent pools, check vendors and AI tools, and erase unsuccessful candidates' data on a fixed schedule.
ReadData Fiduciary vs Data Processor: Who Carries the Liability?
A Data Fiduciary decides why and how personal data is processed, alone or with others. A Data Processor processes it on a fiduciary's behalf. Under the DPDP Act, the fiduciary carries the obligations and the liability, including for its processors (Section 8(1)), and may use processors only under a valid contract (Section 8(2)). Roles are decided activity by activity, and most organisations are both.
ReadDPDP for HR Leaders: What You Own and What to Do First
HR holds more personal data than almost any other function: candidates, employees, contractors, interns and former staff, much of it sensitive. Under the DPDP Act, most employment processing can rely on the Section 7(i) legitimate use rather than consent, but notices, security, vendors, retention limits and breach reporting all still apply. HR leaders should map their data, separate employment needs from extras, tighten vendor contracts and set retention schedules before 13 May 2027.
Read